self_host.dag: ground source_text_code_unit_digest on atom_identity_hash + widen realized-comparison roster off 2-file hardcode

[briansrls]

Summary

• source_text_code_unit_digest (src/v2/compiler/self_host.dag) no longer walks the text character-by-character through byte_limb_hash_peano_digest (a Peano/unary digest that recurses proportional to each character's codepoint magnitude via combine_hash/atom_identity_hash). It now calls the host atom_identity_hash intrinsic directly on the whole string — same fnv1a64 primitive, no unary unwind.
• dag/tools/self_host_realized_comparison_transport.dag: deleted the dead realized_comparison_ci_subset_roster 2-file hardcode (["lib.rs", "v1_rt.rs"]) — confirmed zero consumers anywhere in src/v1/dag (see verification below).
• src/v2/workflow/self_host_realized_comparison_claims.dag: the staleness-gate claim now calls source_models_from_manifest_and_roots (reads the full roster_manifest.txt produced by regen_stage0 --write-manifest) instead of source_models_from_roster_and_roots against the 2-file hardcode — the fold now covers whatever regen_stage0's emit roster actually is, not a hand-picked subset.
• src/v2/workflow/self_host_realized_comparison_gate.dag: deleted the self_host_realized_comparison_gate_interim Terminal scaffold-disposition — its own stated dissolution trigger ("dissolves when source_text_code_unit_digest is host-grounded and fold widens to full roster") is exactly what this PR does.

Why (DESIGN §3 fnv1a64 dual-surface thread)

DESIGN.md names an open fork: raw atom_identity_hash/hash_combine intrinsic calls vs the std.content_hash wrapper module, warning against a third surface. This change is not a third surface:

• symbol_identity_digest (src/v2/std/node.dag) — already used elsewhere in this same file — is itself atom_identity_hash(s: sym), a direct call. 51 direct atom_identity_hash call sites already exist in src/v2/std/node.dag, including inside byte_limb_hash_peano_digest itself (the old algorithm is fnv1a64-based too — it differs from the new one only in how many times it's invoked per character, not in which primitive it uses).
• std.content_hash's ContentHash (a branded NonEmptyStr, dag/std/content_hash.dag) is a different nominal type from v2.std.node.Hash, used by an unrelated neighborhood (roadmap/design-doc/merge-admission tooling) with no established coercion to Hash. Routing self_host.dag through it would require inventing that coercion, not reusing an authority.
• So this fix matches the dominant existing idiom in the same file/module, not a new one.

Verification (point 2 — digest correctness, not just compiles)

self_host_snake_closes(stage1, stage2) -> Bool { stage1.digest == stage2.digest } is the actual fixed-point predicate. Digests on both sides are computed fresh via the current digest function — there is no persisted/golden hash value anywhere in the corpus. Correctness therefore requires the digest be a deterministic, discriminating function of the text (same text -> same digest, different text -> different digest), not that it numerically match the old Peano chain's specific outputs.

Ran all tests in src/v2/test/claim/execution/self_host_fixed_point_test.dag live against the new digest via gunbc run --claim-run (real interpreter execution, not typecheck/grep):

• 15/15 pass, including the exact equal-text / perturbed-text discriminating pair the property needs: self_host_fixture_source_models_at_fixpoint (identical text both stages -> self_host_snake_closes holds) and self_host_fixture_source_models_perturbed_regen (different text on stage2 -> self_host_snake_closes fails, self_host_fixed_point_digests_diverge_on_perturbed_regen_source holds).
• Also covers: self_host_fixed_point_digests_match_on_equal, self_host_bytes_digest_source_perturb_teeth_holds, fixed_point_scaffold_holds_on_equal / _violates_on_perturbed_regen_source, self_host_fixpoint_witness_holds_on_equal_stages / _violates_on_perturbed_regen_source, stage_emission_equality_holds_on_equal / _violates_on_perturbed, self_host_fixed_point_fails_closed_until_regen_byte_pair, self_host_fixed_point_validate_accepts_matching_regen_bytes / _rejects_perturbed_regen_bytes.

This proves the new digest preserves the semantic property the fixed-point comparison actually depends on: same-bytes-in -> same-digest-out, different-bytes-in -> different-digest-out — the fixpoint stays sound because the digest is semantically equivalent for this purpose, not because any comparison got weaker (the comparison — a plain == on two freshly-computed Hash values — is unchanged).

Roster-widen verification (no silent gap)

• realized_comparison_ci_subset_roster deletion: grepped the full src/v1 + dag trees (a strict superset of whatever subset of modules bootstrap_fixed_point's stage0->1 self-compile actually resolves) for the symbol — zero matches. The only other file referencing the containing module at all (dag/tools/regen_verify_transport.dag) doesn't reference this decl either. The deletion has no consumers.
• The staleness-gate claim now folds over roster_manifest.txt, written by regen_stage0 --emit-fresh --write-manifest from GENERATED_STAGE0_FILES — i.e. whatever regen_stage0 actually emits, not a maintained-by-hand 2-file list. This is the full roster by construction (source of truth = the manifest write-out), not a fixed count I'm asserting.

Ground truth on the §7 fixed-point gate (point 1 — bootstrap_fixed_point/ci_fixed_point)

bootstrap_fixed_point (src/v1/tests/src/bootstrap.rs) was #[ignore]d and never wired to CI. Ran it for real, then isolated the finding with an A/B:

• Local run (release binary, cargo test ... bootstrap_fixed_point -- --ignored --nocapture): FAILED at the very first self-compile step (stage0->1), not a timeout — test result: FAILED ... finished in 2202.09s, panic at bootstrap.rs:450 with empty stderr.
• Direct repro of the identical command (gunbc compile --source-root src/v1 --source-root dag --output-dir <dir>), isolated (nothing else running on the box, confirmed via ps aux), run on both sides:
  • My branch (includes this PR): resolved 89 sources (transitive import closure) -> SIGKILL, exit=137.
  • origin/main @ bc639ae4769 (pre-this-PR, built fresh in a separate worktree): resolved 89 sources (transitive import closure) -> SIGKILL, exit=137. Identical failure point, identical signature.
• Conclusion: this is a pre-existing, isolated, reproducible OOM/resource-ceiling failure in the §7 fixed-point gate's stage0->1 self-compile — it reproduces identically with or without this PR's diff. bootstrap_fixed_point's source roots are [src/v1, dag] only; this PR's only dag/-tree change is the dead-data deletion proven zero-consumer above, and its other 3 changed files are all under src/v2/, outside this test's source-root scope entirely.
• This is real, previously-unknown ground truth on an open DESIGN.md §7 hole (the fixed point currently cannot even complete stage0->1 in this container, let alone reach the stage1<->stage2 comparison) — it is not something this PR introduces or is scoped to fix; it's a separate, now-documented gap for its own follow-up.
• ci_fixed_point: not separately exercised — bootstrap_fixed_point already establishes the stage0->1 self-compile does not complete in this environment, which is the shared precondition both tests depend on.

Separately, regen_stage0 --emit-fresh (needed to populate the roster-manifest fixture for the widened staleness-gate claim) was run isolated and did not complete in bounded time either: RSS climbed 1.9GB -> ~20.3GB over ~4h35m then plateaued (non-terminating or pathologically slow, CPU pegged at 100%), independent of contention. Killed after confirming the plateau added no new information. This is a second, independent whole-tree .dag operation hitting the same environment-level resource ceiling — also flagged as its own gap, not this PR's to fix.

Test plan

• gunbc run --claim-run against all 15 relevant tests in self_host_fixed_point_test.dag — all green, live execution
• Zero-consumer grep for the deleted realized_comparison_ci_subset_roster across src/v1 + dag
• Isolated A/B repro of bootstrap_fixed_point's stage0->1 self-compile (branch vs. pre-PR main) — identical pre-existing failure both sides
• self_host_realized_comparison_staleness_gate_holds against a real regen_stage0 --emit-fresh manifest — blocked on the environment-level non-termination documented above, not on this PR's logic

[gunbai-bot]

Reviewed — no findings to address, this is a clean APPROVE with no blocking concerns raised. Confirms the digest-grounding, manifest-driven roster widen, and Terminal-scaffold dissolution all match the stated intent, and correctly notes this isn't a third fnv1a64 surface. No action needed.

— sent from sunny-heron-257

[gunbai-bot]

Confirmed, no findings to address — clean APPROVE, second distinct provider. No action needed.

— sent from sunny-heron-257

[gunbai-bot]

No findings, no action needed — consistent with the two prior APPROVE reviews on this head.

— sent from sunny-heron-257